Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Executive summary

The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

5 min read1 figure0 tables12 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
    1. S.1 Abstract
    2. S.2 Key messages
    3. S.3 Headline finding
    4. S.4 At a glance
    5. S.5 What each steward reads in it
    6. S.6 What this edition is, and is not
  3. 1Lifelines fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Power loss that overlaps a telecom or cloud failure
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

S.1Abstract

Lifeline systems are the networks other systems run on: power, water, communications, transport and health services. The 2025 and 2026 evidence shows the same mechanisms at work in very different events. The Iberian blackout of 28 April 2025 came from interacting factors, including voltage control gaps, oscillations and generator disconnections1. A single software update on 18 July 2024 affected an estimated 8.5 million Windows devices4. Government agencies assessed in February 2024 that state-sponsored actors had pre-positioned in the networks of communications, energy, transport and water operators, with some intrusions lasting at least five years2. ENISA analysed 4,875 incidents in a single twelve-month period3. Asset condition and investment are part of the picture: the 2025 US report card grades the country’s infrastructure C with a USD 3.6 trillion ten-year gap6. Around 199 subsea cable faults occur each year, about two thirds from fishing and transport vessels7. War adds direct damage: Ukraine’s recovery needs reached USD 587.7 billion and Gulf power and desalination plants were struck from March 20261213. This baseline reads these events as mechanisms, not as a list. It ranks no country or operator, attributes no attack and recommends no policy.

S.2Key messages

Six readings that frame the lifeline systems baseline, and the eight questions this edition answers, each with its status and source.

  1. Yes: hazards, cyber operations, conflict and software faults recur across sectors.12410

    Do lifeline failures have common causes?Reported

  2. Through shared dependence on power, telecoms and software.14

    How do failures spread?Reported

  3. Grades are mixed: C overall in the 2025 US report card.6

    Is the physical base sound?Reported

  4. About 199 faults a year; most are accidental.7

    How exposed are subsea links?Reported

  5. More than USD 250 billion a year to infrastructure from three hazards.10

    How large are the losses?Reported

  6. It adds direct damage to power and water systems.1213

    Does war change the picture?Reported

  7. Concentrated demand on local grids.89

    What does digital load add?Reported

  8. Power loss that overlaps a telecom or cloud failure. SCN-SR02-PWR-01

    What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-006

Subsea cable faults averaged 199 a year from 2010 to 2023. About two thirds came from fishing and transport vessels, and intent is hard to establish.

Figure S.1Subsea cable faults a year, 2010 to 2023
ItemBar, scaled to the largest valueValue
Average faults a year199
of which external aggression (about two thirds)≈133

Source: TeleGeography7. The second bar is a Nexus derivation, method (4), and is approximate.

Most faults are accidents, so route diversity and repair capacity matter more than detecting intent. Governments around the Baltic investigate each fault as potential sabotage, and the analyst notes that severing a few cables is noise rather than a signal7.

S.4At a glance

199faults a year

subsea cables7

8.5million

devices, July 20244

4,875incidents

ENISA, to June 20253

3.6USD trillion

US ten-year gap6

>250USD billion

annual hazard loss10

390USD billion

annual disruption cost, LMICs11

S.5What each steward reads in it

GCRI · KEY T

Technical Truth

The evidence supports reading lifelines as one dependent network.

GRF · KEY M

Public Meaning

For most people lifeline failure arrives as a dark home, a dry tap or a card that will not work.

GRA · KEY F

Capital Meaning

Readiness implications only. Disruption is costly, resilient options are reported to return several times their cost, and the investment gap is large in places.

NEXUS

Synthesis

Lifeline risk is well described event by event and thinly measured as a system.

S.6What this edition is, and is not

What this edition is

A baseline: the 2026 state of the world’s critical infrastructure and lifeline systems and the couplings through which it carries risk into other systems. It synthesises published evidence and ranks no country, company or asset.

What it is not

Not an infrastructure-security ranking, a threat attribution, a vulnerability disclosure or an assessment of any operator, regulator or government. Operation, protection and recovery of infrastructure rest with owners, operators and competent authorities.

What comes next

National, regional and sector evidence feeds the 2027 lifeline systems edition through the federation. Each edition reports what changed against this baseline: observations, source revisions, method changes, scenario updates and corrections.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
  2. 4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  3. 2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  4. 3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  5. 6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
  6. 7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
  7. 12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
  8. 13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
  9. 10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
  10. 8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
  11. 9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
  12. 11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back

Cite this summary

Valadbaygi, S. (Ed.). (2026). Executive summary: Executive summary. In Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems (Baseline Edition 2026, Report No. NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Critical Infrastructure and Lifeline Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

Sector signature

The sectors behind Critical Infrastructure and Lifeline Systems.

A reading aid: the sectors the findings run through and how strongly they depend on each other.

Select corners · hover lines6 / 15 relations

Context

Infrastructure and its partners

Infrastructure gives pipes, dams and treatment works to water (0.6), transmission and fuel logistics to energy (0.6) and access to care to health (0.5).

W · E · I · F · H · B

Sectors
4 of 6
Relations
6 of 15
Coupling
0.46 share of total

Strongest relations in play

  • Energy → Infrastructure · power for transport and telecoms0.8
  • Water → Energy · cooling water and hydropower0.6
  • Infrastructure → Water · pipes, dams and treatment works0.6
  • Water → Health · drinking water and sanitation0.7
Teaching values for a typical city-region, not measurements for any place. Coupling is the summed strength of the relations in play, as a share of all fifteen.
The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices